# Allowlist removal strands funds

Removing an address, gauge, or version from an allowlist while balances or votes still reference it

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-10-31. Updated 2026-10-23._

## How it works
An allowlist (or version set, or gauge registry) is treated as a gate for *new* actions, but existing state — balances, votes, collateral, receipts — still points at the removed entry. The code then requires the entry to be present for the *exit* path too, so the state can never be unwound. The broken assumption: that removing an entry only stops future use, when in fact it also freezes everything already tied to it.

## Where it shows up
- `transferFrom`/hook overrides that require `from` or `to` to be in a fixed set of protocol contracts [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md)
- `withdraw()` or redeem paths with a `require(isWhitelisted[asset])` check [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md)
- Vote/reset functions that require a registry entry to be nonzero or valid [E2](https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md)
- Admin functions (`remove_gauge`, de-whitelist, version bump) with no migration or sweep for stranded state [E2](https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md)
- Auction, escrow, or liquidator contracts that must custody a token but are absent from its allowlist [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md)

## How to review
For every allowlist/registry, enumerate all contracts and users that must send or receive the gated asset, and check each against the list [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md). For every removal path, ask: after removal, can holders still exit, reset, or redeem? The invariant: **removing an entry must not make any existing balance, vote, or receipt unreachable, and total redeemable backing must stay >= outstanding supply** [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md). Check that reset/exit functions accept removed entries (e.g. weight 0 allowed for type 0) [E2](https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md).

## Variants seen
- Transfer-hook allowlist omits the auction contract, so collateral cannot be bought [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md)
- Gauge removal plus a `gauge_type >= 0` require blocks vote reset, locking voting power [E2](https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md)
- De-whitelisting one backing asset strands its balance while supply stays redeemable against others, enabling first-mover drain and DoS [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md)

## Why fixes fail
E2 shows a prior fix (require on gauge type) re-breaking the exact path it was meant to repair: the new validation reverts for removed gauges. Diff any fix against the original scenario and re-test the removal path.

## Impact and severity
Frozen lender funds [E1](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md), permanently locked voting power [E2](https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md), stranded backing plus drain and withdrawal DoS [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md). Severity rises when supply stays constant while redeemable backing shrinks, letting early exiters drain the rest [E3](https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AH-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-03-neobase%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03.md